Sunday, December 3, 2023

Millions of Routers are Actively Exploited Through Bypasses Authentication Bug

The security researcher at the information security company Tenable Evan Grant detected that a serious security violation puts millions of routers at risk all over the world.

According to the report of a security analyst, this is a critical vulnerability that circumvents the authentication and attacks the home devices that are using Arcadyan firmware. 

However, this attack generally enables the threat actors to control them and to implement the attacks utilizing the Mirai botnet.

Millions of Routers Are Vulnerable

After investigating the attack, the security analysts came to know that this vulnerability has attacked millions of routers models from different merchants and ISPs, that also includes:- 

  • Asus
  • British Telecom
  • Deutsche Telekom
  • Orange
  • O2 (Telefonica)
  • Verizon
  • Vodafone
  • Telstra
  • Telus

The security vulnerability has been detected by the Tenable, which is tracked as “CVE-2021-20090” with a CVSS score of 9.9 and after detecting the attack they published about it on April 26, not only this, recently, the experts have also provided some proof of concept exploit code.

However, the cybersecurity experts have studied the matter clearly, and based on the number of routers as well as the merchants that are infected by this vulnerability attack are increasing rapidly and went to millions, that’s why the experts are trying their best to detect all the infected devices.

Attack Details

After investigating the security experts came to know that the attack was started from the IP address 27.22.80[.]19 over HTTP. Moreover, the attackers have modified the configuration of all the attacked devices, and it allows the Telnet to utilize “ARC_SYS_TelnetdEnable=1”.

Once it does, after that it moves to download a new script from the IP address 212.192.241[.]72 utilizing either wget or curl and then administers the whole operation that they have planned.

List of all known affected devices and vendors 

The security experts have mentioned the full list of the affected devices and vendors, and here below we have mentioned an image in which the full list is mentioned:-

Attacks start two days later the PoC exploit release

The most interesting point is that the security lab Juniper Threat has detected some attack patterns that are trying to exploit this vulnerability and after investigating it the analysts came to know that it was coming from IP addresses that are initially located in Wuhan, Hubei province, China.

However, in this attack, the cybercriminals are using some malicious tools so that they can deploy a Mirai botnet variant, and it is quite similar to those which were used in a Mirai campaign that is targeting IoT and network security devices.

In both the attacks, there are some similarities, and the researchers stated that after studying the similarities it indicates that the threat actors that are behind these attacks are the same.

However, to know the exact details of these attacks, the security analysts are investigating the whole matter, and they have claimed that they will soon disclose the details of this attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles